Privacy Policy

NutriSelect is an e-commerce brand owned and operated by NMAC Group, a proprietorship / business entity based in Mansa, Punjab, India.

Registered address: New Mangla Atta Chakki, Near Co-operative Bank, Boha, Mansa, Punjab — 151503

Contact email: nutriselect@nmacgroup.in

We collect the following personal information when you register, place an order, or contact us:

• Identity data: Full name, email address, mobile phone number.
• Account data: Encrypted password (if you register with email/password), Google account identifier (if you use Google Sign-In), avatar colour preference.
• Address data: Delivery address including house/flat number, street, city, state, and PIN code.
• Order data: Products ordered, quantities, order value, payment method, payment reference ID (provided by Razorpay), coupon codes applied, order status history.
• Communication data: Support messages and admin replies exchanged through the in-app support system.
• Technical data: IP address (for rate limiting and fraud prevention), session token (stored in a secure httpOnly cookie, not accessible by scripts).

We do not collect or store your full card number, CVV, or bank account details. All payment processing is handled by Razorpay, which is PCI-DSS compliant.

• To create and manage your account.
• To process, fulfil, and deliver your orders.
• To send OTP verification codes via SMS for account registration, phone updates, and password reset.
• To send in-app notifications about your order status (confirmation, dispatch, delivery, refunds).
• To respond to your support queries.
• To prevent fraud, abuse, and ensure platform security (rate limiting, duplicate-payment detection, stock integrity).
• To meet our legal and regulatory obligations under the IT Act 2000, GST laws, and FSSAI regulations.

We do not use your data for targeted advertising, and we do not sell your data to any third party.

We share your information with the following third parties only as necessary to operate the service:

• Razorpay Financial Solutions Pvt. Ltd. — payment processing. Your payment information is transmitted directly to Razorpay's secure servers. Razorpay's privacy policy: razorpay.com/privacy
• Google LLC — optional Google Sign-In (OAuth 2.0). If you choose to sign in with Google, we receive your verified Google email address and display name. Google's privacy policy: policies.google.com/privacy
• Fast2SMS / SMS gateway provider — for sending OTP verification codes to your registered phone number.
• Supabase Inc. — our database and backend infrastructure provider. Your data is stored on Supabase-managed PostgreSQL servers. Supabase complies with GDPR and applicable data protection regulations.
• OpenStreetMap / Nominatim — for address autocomplete during checkout. We proxy these requests through our server; your coordinates or search query are sent to Nominatim but are not stored by us.

Your personal data is stored on Supabase-managed servers. We retain your data as follows:

• Account data — retained for as long as your account is active, or until you request deletion.
• Order data — retained for a minimum of 7 years as required by GST and financial record-keeping laws.
• OTP codes — expire within 10 minutes and are marked as used after verification. Expired records are cleaned up periodically.
• Session tokens — expire after 7 days of inactivity. Logging out immediately invalidates the session cookie on your device.

We use only strictly necessary cookies:

• ns-session — an httpOnly, secure session cookie that keeps you signed in. It is not accessible by JavaScript and cannot be read by third-party scripts. Expires after 7 days.
• Google Analytics 4 (GA4) — we use Google Analytics to understand aggregate website usage (pages viewed, session duration, device type). GA4 may set its own cookies (e.g., _ga, _gid) and send anonymised usage data to Google servers. No personally identifiable information is sent. You can opt out using the Google Analytics Opt-out Browser Add-on or by enabling Do Not Track in your browser.

We do not use advertising cookies or remarketing pixels. We do not sell or share your analytics data with third parties for advertising purposes.

Under India's Digital Personal Data Protection Act 2023 and the IT (Reasonable Security Practices) Rules 2011, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data (you can update your name, phone, and address from your account settings).
• Delete your account and personal data (subject to our legal retention obligations for order records).
• Withdraw consent for any optional data processing (e.g., marketing, though we currently do none).
• Raise a grievance with our Grievance Officer (see Section 10 below).

To exercise any of the above rights, email us at nutriselect@nmacgroup.in. We will respond within 30 days.

We take reasonable technical and organisational measures to protect your data:

• Passwords are hashed using bcrypt (12 rounds) and never stored in plain text.
• Session cookies are httpOnly, Secure, and SameSite=Lax — resistant to XSS and CSRF attacks.
• All data in transit is encrypted via HTTPS (TLS 1.2+).
• Admin access to customer data is restricted to verified administrators via live database checks on every request.
• Payment signatures from Razorpay are cryptographically verified using HMAC-SHA256 before any order is confirmed.

In the unlikely event of a data breach, we will notify affected users and the relevant authorities within 72 hours as required by law.

NutriSelect is not directed at children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

In accordance with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and the Consumer Protection (E-Commerce) Rules 2020, we have designated a Grievance Officer:

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of NutriSelect after a change constitutes acceptance of the updated policy. For significant changes, we will send an in-app notification.